New DMCA Exemption Allows Consumers to Hack Their Own Vehicles

In a world in which we will soon see fully-autonomous, self-driving vehicles on the road, the Digital Millennium Copyright Act ("DMCA") appears to have taken at least one major step towards supporting car owners.

The DMCA prohibits users of copyrighted works from circumventing technological protection measures ("TPMs") that prevent access to copyright protected material, subject to limited exemptions.1 Every three years the Librarian of Congress sets forth classes of copyrighted works that may be exempt from the anti-circumvention statute.2

On October 28, 2015, the Librarian of Congress approved an exemption to the DMCA, which became available on October 28, 2016 and relates to vehicle repair and modification. The new temporary exemption allows circumvention of TPMs protecting computer programs that control motorized land vehicles, including cars and mechanized agricultural vehicles, when circumvention is "a necessary step . . . to allow the diagnosis, repair or lawful modification of a vehicle function."3

This means that consumers no longer have to take their cars to authorized repair shops or buy expensive manufacturer-authorized tools to diagnose and repair their vehicles in all instances, and can instead work on their own vehicles without fear of facing a legal claim under the DMCA. The exemption requires circumvention to be carried out by the "authorized owner" of the vehicle, and does not cover third parties.4 Out of concern that circumvention might allow unauthorized access to creative or proprietary content, the exemption expressly excludes computer programs in electronic control units ("ECUs") that are mainly designed to operate vehicle entertainment and telematic systems.5

Another exemption became effective on the same date, October 28, 2016, which allows access to copyrighted works and reverse engineering of various consumer products for investigation or correction of a security vulnerability, so long as research does not violate other laws (such as the Computer Fraud and Abuse Act).6 However, this exemption does not appear to broadly apply to consumers because it requires the purpose of circumvention to be "solely for the purpose of good-faith security research" which means in part that the research is carried out in a "controlled environment to avoid any harm to individuals or the public."7

Both of these exemptions expire on October 28, 2018 unless successfully renewed in the next rule making cycle by the Librarian of Congress. So, for the next two years or so, owners can modify the computer code in their vehicles for certain legitimate purposes without fear of a claim under the DMCA's anti-circumvention provisions.